For Safari on Mac and iPhone, choose a system-wide virtual private network (VPN) app or iCloud Private Relay. The former routes connections from Safari and other apps through an encrypted tunnel. The latter protects your browsing in Safari and is included with iCloud+. The usual VPN extension model from Chrome and Firefox is unavailable here: Safari does not support the proxy management interface for web extensions.
Why can't you simply add a VPN plug-in to Safari?
Many browser-based VPNs work via a proxy: an intermediary server passes requests on to websites. An extension manages such connections through a programming interface (API), that is, a set of commands provided by the browser.
According to the MDN compatibility table, the proxy interface is not supported in Safari or Safari on iOS. Therefore, the usual proxy-extension model of Chrome or Firefox cannot be used here. This conclusion follows from the compatibility table; Apple's instructions cited do not state a ban on VPNs.
Safari extensions themselves do exist. On Mac, open "Safari → Safari Extensions": the browser will take you to the App Store. Management of installed add-ons is found in "Safari → Settings → Extensions".
Check the permissions. According to Apple's guidance, extensions can read the content of the websites you visit. Access to pages does not in itself create a VPN tunnel, even if the add-on's name contains the word "protection".
If you are willing to use a different browser for the sake of a built-in feature, compare browsers with a built-in VPN and their limitations.
Which approach protects Safari and other apps?
Choose based on the scope of connections covered. The difference between a browser-based and a system-wide VPN is examined in detail on the main page. The following options are available for Safari:
| Approach | What it covers | Subscription required | Main limitation |
|---|---|---|---|
| Safari extension | Features on pages, within the granted permissions | Depends on the add-on | No proxy API for the usual proxy-extension model |
| iCloud Private Relay | Website browsing in Safari | iCloud+ required | Not a replacement for a whole-device VPN; not available in all countries |
| System-wide VPN client | Safari and the other apps whose traffic is routed through the tunnel | Depends on the service | Coverage depends on the client and routing settings |
An app excluded from the system tunnel by the settings will continue to connect directly.
How does iCloud Private Relay work and how do you enable it?
Private Relay splits information between two intermediaries. An internet protocol address (IP address) serves as the network address of your connection. Private Relay substitutes a temporary address for it.
The path of a request: your device → Apple relay → third-party operator's relay → website.
Private Relay splits information between two intermediaries.
According to Apple's description, neither of the two relays ever receives both the original IP and the site's name at the same time.
Private Relay substitutes a temporary address for it.
| Participant in the connection | Which IP it sees | Does it see the name of the requested website |
|---|---|---|
| Your network provider | The original IP | In the described Private Relay scheme, the site's name is hidden |
| The first relay, Apple | The original IP | No, the information about the requested name is encrypted |
| The second relay, the third-party operator | Receives the connection via the first hop and issues the temporary IP | Yes, it decrypts the name and connects to the website |
| The website being opened | The temporary IP | Yes, it receives the request addressed to it |
According to Apple's description, neither of the two relays ever receives both the original IP and the site's name at the same time.
To enable the feature:
- On iPhone: open "Settings → your name → iCloud → Private Relay" and turn it on.
- On Mac: open "System Settings → your name → iCloud → Private Relay" and turn on the feature.
An iCloud+ subscription is required. Private Relay is not available in all countries and regions; bear this in mind when travelling from the UK.
How do you connect Safari together with the rest of your apps?
For overall network protection, choose a system-wide VPN client. It creates an encrypted tunnel from the device to a server: Safari, mail and other apps can all travel through it. At the same time, you entrust the handling of your connections to the VPN operator, as explained in the EFF guide.
For Safari together with the rest of the apps on an iPhone or Mac, you can choose Streisand, V2Box or Shadowrocket — clients for Apple platforms listed in the provider's guide. As the subscription for such a client, I recommend CitadelVPN. The service has no app or Safari extension of its own. Check support for your system version before installing: there is no independent testing of these combinations here.
The connection procedure is short:
- Choose a client: verify the platform and the publisher so that you do not install an app with an identical name.
- Add the subscription link: get it from your CitadelVPN dashboard and import it into the client. Via this link, the client receives a list of connections.
- Refresh the list: select a connection and enable it. The button names vary between apps.
- Check the coverage: make sure the apps you need are routed through the tunnel.
How do you verify that the connection works?
Compare the public IP address before and after connecting in Safari, then repeat the check in another app, such as a different browser. To test the VPN specifically, temporarily disable Private Relay: otherwise, the changed address in Safari may simply be Private Relay at work.
If the address changed only in Safari, check the client's exclusion rules. An IP change does not prove the absence of all leaks. For details, see the guide on how to compare the IP in a browser and another app.
Frequently asked questions
Why does searching for a VPN in the App Store not turn up the standard Safari extension?
The App Store distributes both apps and extensions, so a name you find does not by itself determine the connection method. Check the description: whether a separate system-wide client is required, what exactly it routes through the tunnel, and who published it.
How do you limit an installed extension's access to pages?
On Mac, click the extension's button on the Safari toolbar and set the level of access to websites. If you no longer need the add-on, disable or remove it in "Safari → Settings → Extensions".
Does an extra check on a website mean Private Relay is broken?
No, an extra check like this does not in itself mean anything is wrong. Apple warns that, without access to the original IP, some websites require additional steps to sign in or gain access. Complete the check offered by the website and sign in again.
What to choose for your task
If you use iCloud+ and want to protect your browsing in Safari, enable Private Relay in the iCloud settings. If mail and other Mac or iPhone apps should also travel through the protected connection, install a system-wide VPN client and check its coverage. Looking for an ordinary proxy extension for Safari is pointless: the proxy API it needs is not supported.